Help Needed - several problems
- Thread starter pmaxxx13
- Start date
- Status
All processes killed
========== PROCESSES ==========
========== OTL ==========
No active process named Program Files was found!
No active process named Program Files was found!
Error: No service named AVGIDSAgent was found to stop!
Service\Driver key AVGIDSAgent not found.
File C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe not found.
Error: No service named avgwd was found to stop!
Service\Driver key avgwd not found.
File C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe not found.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
File C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
File C:\Program Files (x86)\AVG\AVG2012\avgssie.dll not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_USERS\S-1-5-21-1554704811-4091891495-1094212442-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.
ADS C:\ProgramData\TEMP
FC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:430C6D84 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Connor Appleby\Desktop\cmd.bat deleted successfully.
C:\Users\Connor Appleby\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully
[EMPTYTEMP]
User: All Users
User: Connor Appleby
->Temp folder emptied: 1298329 bytes
->Temporary Internet Files folder emptied: 483997261 bytes
->Java cache emptied: 62996726 bytes
->Google Chrome cache emptied: 10230968 bytes
->Apple Safari cache emptied: 152968192 bytes
->Flash cache emptied: 2932317 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Sarah
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 315 bytes
->Java cache emptied: 2311255 bytes
->Apple Safari cache emptied: 16384 bytes
->Flash cache emptied: 60081 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1712545 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33237 bytes
RecycleBin emptied: 1416 bytes
Total Files Cleaned = 685.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 01072012_093507
Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC42.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC47.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC81.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC87.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFCB8.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFCBD.tmp not found!
C:\Users\Connor Appleby\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2EZAMGD\showthread[1].htm moved successfully.
C:\Users\Connor Appleby\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\Windows\temp\mcafee_3XL14cIkMoU3KRI not found!
Registry entries deleted on Reboot...
========== PROCESSES ==========
========== OTL ==========
No active process named Program Files was found!
No active process named Program Files was found!
Error: No service named AVGIDSAgent was found to stop!
Service\Driver key AVGIDSAgent not found.
File C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe not found.
Error: No service named avgwd was found to stop!
Service\Driver key avgwd not found.
File C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe not found.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
File C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
File C:\Program Files (x86)\AVG\AVG2012\avgssie.dll not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_USERS\S-1-5-21-1554704811-4091891495-1094212442-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.
ADS C:\ProgramData\TEMP
FC5A2B2 deleted successfully.ADS C:\ProgramData\TEMP:430C6D84 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Connor Appleby\Desktop\cmd.bat deleted successfully.
C:\Users\Connor Appleby\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully
[EMPTYTEMP]
User: All Users
User: Connor Appleby
->Temp folder emptied: 1298329 bytes
->Temporary Internet Files folder emptied: 483997261 bytes
->Java cache emptied: 62996726 bytes
->Google Chrome cache emptied: 10230968 bytes
->Apple Safari cache emptied: 152968192 bytes
->Flash cache emptied: 2932317 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Sarah
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 315 bytes
->Java cache emptied: 2311255 bytes
->Apple Safari cache emptied: 16384 bytes
->Flash cache emptied: 60081 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1712545 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33237 bytes
RecycleBin emptied: 1416 bytes
Total Files Cleaned = 685.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 01072012_093507
Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC42.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC47.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC81.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFC87.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFCB8.tmp not found!
File\Folder C:\Users\Connor Appleby\AppData\Local\Temp\~DFCBD.tmp not found!
C:\Users\Connor Appleby\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2EZAMGD\showthread[1].htm moved successfully.
C:\Users\Connor Appleby\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\Windows\temp\mcafee_3XL14cIkMoU3KRI not found!
Registry entries deleted on Reboot...
ken545
Emeritus-Security Expert
McAfee has its own firewall and will turn the windows firewall off by default which is fine, you dont need them both
You can post here in there windows forum for help with your windows updates, you can link them to this thread so they can see what we have done.
http://forums.whatthetech.com/index.php?showforum=119
Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.
Malwarebytes is the free version and yours to keep and will not be removed
Safe Surfn
Ken
You can post here in there windows forum for help with your windows updates, you can link them to this thread so they can see what we have done.
http://forums.whatthetech.com/index.php?showforum=119
- Click START then RUN
- Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.
Malwarebytes is the free version and yours to keep and will not be removed
How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.- Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
- WhattheTech
- Grinler BleepingComputer
- GeeksTo Go
- Dslreports
Safe Surfn
Ken
- Status